The Ministry of Health is having to explain why it took two months to inform people about a huge data breach

It was told about the hack of Tu Ora's system in early August.

Director of Health Dr Ashley Bloomfield says they wanted to make sure they knew what they were dealing with.

He says they wanted to wait for the National Cyber Security Centre to investigate the breach... which revealed additional illegal intrusions.

Dr Bloomfield says the Ministry then worked on closing all the security gaps discovered... and set up a team to help affected people.

Health data of a million patients from the lower North Island may have been stolen during several different hacks.